Rule packs
Select a Foo Guard catalog or a related-check pack for OWASP and SOC 2 criteria. These packs are not a certification.
A scan can keep the registered Foo Guard catalog or start from a related-check pack.
The packs are:
- Foo Guard catalog, the existing default scan
- OWASP Top 10 for LLM Applications, version 2025, released 2024-11-18
- OWASP Top 10 for Agentic Applications 2026, released 2025-12-09
- AICPA Trust Services Criteria (2017), Security category, criteria CC6.1, CC6.2, CC6.3, and CC7.2
A framework entry is recorded as assessed only when every related check for that entry stays selected. Unselected checks are not a pass. Secret checks still run. Fail-on, minimum grade, and policy exceptions stay separate from the pack.
Each saved scan stores the pack id, pack version, catalog version, and selected rule ids. Scores from different selections are not equivalent.
These packs are configuration checks that can help work toward a framework. They are not an OWASP certification, a SOC 2 examination, or a complete compliance assessment.
Repository CI and the v1 analyze API keep the registered catalog. They do not accept a rule pack.